AMENDMENTS TO THE CLAIMS 



1. (Currently Amended) A computer-implemented method for 
analyzing a virtual function, said method comprising: 

locating determining whether a virtual table exists for a virtual 
function , said virtual table comprising a start address for said virtual 
function : and 

determining a call type for said a virtual function: 

creating an instruction for said virtual function, said instruction 
comprising a control transfer function that directs execution to 
instrumentation code: and 

rewriting said virtual table with a modified virtual table comprising 
an address for said instruction instead of said start address, wherein upon a 
call to said virtual function, said address for said instruction is loaded . 

2. (Currently Amended) The computer-implemented method for 
analyzing a virtual function as recited in Claim 1 further comprising the 



performing instrumentation on said virtual function based upon said 
call type. 

3. (Original) The computer-implemented method for analyzing a 
virtual function as recited in Claim 1 wherein said call type is selected from 
the group comprising direct, indirect, and virtual. 

4. (Currently Amended) The computer-implemented method for 
analyzing a virtual function as recited in Claim 2 wherein the step of 
performing instrumentation on said virtual function based upon said call 
type comprises: 

provided said virtual table io located, replacing an existing address 



step of : 
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for said virtual function with a new address for said virtual function in said 
virtual table such that said now addrooo points to instrumentation code; 

upon a call to said virtual function, load said now address from said 
virtual table o uch that execution is directed to the instrumentation code; 

nr\rl 
WL1XX 

continue execution and execute executing said instrumentation code 
such that control is delivered to said instrumentor. 

5. (Currently Amended) The computer-implemented method for 
analyzing a virtual function as recited in Claim 4 further comprising: 

performing a desired instrumentation task by said instrumentor; and 
resume resuming execution by said instrumentor at said start 
existing address previously contained in said virtual table. 

6. (Currently Amended) The computer-implemented method for 
analyzing a virtual function as recited in Claim 4 further comprising: 

overwriting said instrumentation code with instrumentation code 
which performs a desired instrumentation task; and 

provide providing an instruction at the end of said instrumentation 
code wherein said instruction points back to said start existing address 
previously contained in said virtual table. 

7. (Original) The computer-implemented method for analyzing a 
virtual function as recited in Claim 1 further comprising: 

determining from which location said virtual function has been called. 

8. (Currently Amended) The computer-implemented method for 
analyzing a virtual function as recited in Claim 4 further comprising: 

maintaining a mapping between said start existing address for said 
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virtual function and said Hew address for said instruction virtual function . 

9. (Currently Amended) A computer-readable medium embodying 
instructions that cause a computer to perform a method for analyzing a 
virtual function, said method comprising: 

locating determining whothor a virtual table oxiots for a virtual 
function , said virtual table comprising a start address for said virtual 
function ; and 

determining a call type for said a virtual function; 

creating an instruction for said virtual function, said instruction 
comprising a control transfer function that directs execution to 
instrumentation code; and 

rewriting said virtual table with a modified virtual table comprising 
an address for said instruction instead of said start address, wherein upon a 
call to said virtual function, said address for said instruction is loaded . 

10. (Currently Amended) The computer-readable medium of Claim 9 
further comprising instructions that cause said computer to perform said 
method further comprising the step of : 

performing instrumentation on said virtual function based upon said 
call type. 

11. (Original) The computer-readable medium of Claim 9 wherein 
said call type is selected from the group comprising direct, indirect, and 
virtual. 
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12. (Currently Amended) The computer-readable medium of Claim 
10 further comprising instructions that cause said computer to perform said 
method further comprising the otop of : 

provided oaid virtual table is located, replacing an existing address 
for said virtual function with a now address for said virtual function in said 
virtual table such that said now address points to instrumentation code; 

upon a call to said virtual function, load said now address from said 
virtual table such that execution i3 directed to the instrumentation code; 

cJ.ll U. 

continue execution and execute executing said instrumentation code 
such that control is delivered to said instrumentor. 

13. (Currently Amended) The computer-readable medium of Claim 
12 further comprising instructions that cause said computer to perform said 
method further comprising the stop s of : 

performing a desired instrumentation task by said instrumentor; and 
resume resuming execution by said instrumentor at said start 
existing address previously contained in said virtual table. 

14. (Currently Amended) The computer-readable medium of Claim 
12 further comprising instructions that cause said computer to perform said 
method further comprising the stops of : 

overwriting said instrumentation code with instrumentation code 
which performs a desired instrumentation task; and 

provide providing an instruction at the end of said instrumentation 
code wherein said instruction points back to said start existing address 
previously contained in said virtual table. 
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15. (Currently Amended) The computer-readable medium of Claim 9 
further comprising instructions that cause said computer to perform said 
method further comprising tho steps of : 

determining from which location said virtual function has been called. 

16. (Currently Amended) The computer-readable medium of Claim 
12 further comprising instructions that cause said computer to perform said 
method further comprising tho otcpo of : 

maintaining a mapping between said start existing address for said 
virtual function and said new address for said instruction virtual function . 

17. (Currently Amended) An apparatus for analyzing a virtual 
function, said apparatus comprising: 

means for locating determining whether a virtual table exists for a 
virtual function , said virtual table comprising a start address for said 
virtual function : and 

means for determining a call type for said a virtual function; 

means for creating an instruction for said virtual function, said 
instruction comprising a control transfer function that directs execution to 
instrumentation code: and 

means for rewriting said virtual table with a modified virtual table 
comprising an address for said instruction instead of said start address, 
wherein upon a call to said virtual function, said address for said instruction 
is loaded . 

18. (Original) The apparatus of Claim 17 for analyzing a virtual 
function, said apparatus further comprising: 

means for performing instrumentation on said virtual function based 
upon said call type. 
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19. (Original) The apparatus of Claim 17 for analyzing a virtual 
function wherein said call type is selected from the group comprising direct, 
indirect, and virtual. 



20. (Currently Amended) The apparatus of Claim 18 for analyzing a 
virtual function, said apparatus further comprising: 

moans for replacing an oxioting address for said virtual function with 
a new address for said virtual function in said virtual tablo such that said 
now address points to instrumentation code, provided said virtual table is 
located; 

means for loading said now address from said virtual tablo ouch that 
execution is directed to the instrumentation code, upon a call to said virtual 
function; and 

means for continuing execution and executing said instrumentation 
code such that control is delivered to said instrumentor. 

21. (Currently Amended) The apparatus of Claim 20 for analyzing a 
virtual function, said apparatus further comprising: 

means for performing a desired instrumentation task by said 
instrumentor; and 

means for resuming execution by said instrumentor at said start 
existing address previously contained in said virtual table. 

22. (Currently Amended) The apparatus of Claim 20 for analyzing a 
virtual function, said apparatus further comprising: 

means for overwriting said instrumentation code with 
instrumentation code which performs a desired instrumentation task; and 
means for providing an instruction at the end of said instrumentation 
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code wherein said instruction points back to said start existing address 
previously contained in said virtual table. 

23. (Original) The apparatus of Claim 17 for analyzing a virtual 
function, said apparatus further comprising: 

means for determining from which location said virtual function has 
been called. 

24. (Currently Amended) The apparatus of Claim 20 for analyzing a 
virtual function, said apparatus further comprising: 

means for maintaining a mapping between said start oxisting 
address for said virtual function and said new address for said virtual 
function. 
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